[thirdparty/hostap.git] / src / ap / drv_callbacks.c

/*
 * hostapd / Callback functions for driver wrappers
 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Alternatively, this software may be distributed under the terms of BSD
 * license.
 *
 * See README and COPYING for more details.
 */

#include "utils/includes.h"

#include "utils/common.h"
#include "radius/radius.h"
#include "drivers/driver.h"
#include "common/ieee802_11_defs.h"
#include "common/ieee802_11_common.h"
#include "common/wpa_ctrl.h"
#include "crypto/random.h"
#include "p2p/p2p.h"
#include "wps/wps.h"
#include "hostapd.h"
#include "ieee802_11.h"
#include "sta_info.h"
#include "accounting.h"
#include "tkip_countermeasures.h"
#include "iapp.h"
#include "ieee802_1x.h"
#include "wpa_auth.h"
#include "wmm.h"
#include "wps_hostapd.h"
#include "ap_drv_ops.h"
#include "ap_config.h"


int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
			const u8 *req_ies, size_t req_ies_len, int reassoc)
{
	struct sta_info *sta;
	int new_assoc, res;
	struct ieee802_11_elems elems;
	const u8 *ie;
	size_t ielen;
	u16 reason = WLAN_REASON_UNSPECIFIED;

	if (addr == NULL) {
		/*
		 * This could potentially happen with unexpected event from the
		 * driver wrapper. This was seen at least in one case where the
		 * driver ended up being set to station mode while hostapd was
		 * running, so better make sure we stop processing such an
		 * event here.
		 */
		wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
			   "no address");
		return -1;
	}
	random_add_randomness(addr, ETH_ALEN);

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "associated");

	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);
	if (elems.wps_ie) {
		ie = elems.wps_ie - 2;
		ielen = elems.wps_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
	} else if (elems.rsn_ie) {
		ie = elems.rsn_ie - 2;
		ielen = elems.rsn_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
	} else if (elems.wpa_ie) {
		ie = elems.wpa_ie - 2;
		ielen = elems.wpa_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
	} else {
		ie = NULL;
		ielen = 0;
		wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
			   "(Re)AssocReq");
	}

	sta = ap_get_sta(hapd, addr);
	if (sta) {
		accounting_sta_stop(hapd, sta);
	} else {
		sta = ap_sta_add(hapd, addr);
		if (sta == NULL)
			return -1;
	}
	sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);

#ifdef CONFIG_P2P
	if (elems.p2p) {
		wpabuf_free(sta->p2p_ie);
		sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
							  P2P_IE_VENDOR_TYPE);
	}
#endif /* CONFIG_P2P */

	if (hapd->conf->wpa) {
		if (ie == NULL || ielen == 0) {
#ifdef CONFIG_WPS
			if (hapd->conf->wps_state) {
				wpa_printf(MSG_DEBUG, "STA did not include "
					   "WPA/RSN IE in (Re)Association "
					   "Request - possible WPS use");
				sta->flags |= WLAN_STA_MAYBE_WPS;
				goto skip_wpa_check;
			}
#endif /* CONFIG_WPS */

			wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
			return -1;
		}
#ifdef CONFIG_WPS
		if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
		    os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
			struct wpabuf *wps;
			sta->flags |= WLAN_STA_WPS;
			wps = ieee802_11_vendor_ie_concat(ie, ielen,
							  WPS_IE_VENDOR_TYPE);
			if (wps) {
				if (wps_is_20(wps)) {
					wpa_printf(MSG_DEBUG, "WPS: STA "
						   "supports WPS 2.0");
					sta->flags |= WLAN_STA_WPS2;
				}
				wpabuf_free(wps);
			}
			goto skip_wpa_check;
		}
#endif /* CONFIG_WPS */

		if (sta->wpa_sm == NULL)
			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
							sta->addr);
		if (sta->wpa_sm == NULL) {
			wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
				   "machine");
			return -1;
		}
		res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
					  ie, ielen, NULL, 0);
		if (res != WPA_IE_OK) {
			wpa_printf(MSG_DEBUG, "WPA/RSN information element "
				   "rejected? (res %u)", res);
			wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
			if (res == WPA_INVALID_GROUP)
				reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
			else if (res == WPA_INVALID_PAIRWISE)
				reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
			else if (res == WPA_INVALID_AKMP)
				reason = WLAN_REASON_AKMP_NOT_VALID;
#ifdef CONFIG_IEEE80211W
			else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
				reason = WLAN_REASON_INVALID_IE;
			else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
				reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
#endif /* CONFIG_IEEE80211W */
			else
				reason = WLAN_REASON_INVALID_IE;
			goto fail;
		}
	} else if (hapd->conf->wps_state) {
#ifdef CONFIG_WPS
		struct wpabuf *wps;
		if (req_ies)
			wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
							  WPS_IE_VENDOR_TYPE);
		else
			wps = NULL;
#ifdef CONFIG_WPS_STRICT
		if (wps && wps_validate_assoc_req(wps) < 0) {
			reason = WLAN_REASON_INVALID_IE;
			wpabuf_free(wps);
			goto fail;
		}
#endif /* CONFIG_WPS_STRICT */
		if (wps) {
			sta->flags |= WLAN_STA_WPS;
			if (wps_is_20(wps)) {
				wpa_printf(MSG_DEBUG, "WPS: STA supports "
					   "WPS 2.0");
				sta->flags |= WLAN_STA_WPS2;
			}
		} else
			sta->flags |= WLAN_STA_MAYBE_WPS;
		wpabuf_free(wps);
#endif /* CONFIG_WPS */
	}
#ifdef CONFIG_WPS
skip_wpa_check:
#endif /* CONFIG_WPS */

	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
	sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
	wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);

	hostapd_new_assoc_sta(hapd, sta, !new_assoc);

	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);

#ifdef CONFIG_P2P
	p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
			      req_ies, req_ies_len);
#endif /* CONFIG_P2P */

	return 0;

fail:
	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
	ap_free_sta(hapd, sta);
	return -1;
}


void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta;

	if (addr == NULL) {
		/*
		 * This could potentially happen with unexpected event from the
		 * driver wrapper. This was seen at least in one case where the
		 * driver ended up reporting a station mode event while hostapd
		 * was running, so better make sure we stop processing such an
		 * event here.
		 */
		wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
			   "with no address");
		return;
	}

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "disassociated");

	sta = ap_get_sta(hapd, addr);
	if (sta == NULL) {
		wpa_printf(MSG_DEBUG, "Disassociation notification for "
			   "unknown STA " MACSTR, MAC2STR(addr));
		return;
	}

	sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
		MAC2STR(sta->addr));
	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
	ap_free_sta(hapd, sta);
}


void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta = ap_get_sta(hapd, addr);

	if (!sta || !hapd->conf->disassoc_low_ack)
		return;

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
		       "missing ACKs");
	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
	if (sta)
		ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
}


int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da,
			 const u8 *bssid, const u8 *ie, size_t ie_len)
{
	size_t i;
	int ret = 0;

	if (sa == NULL || ie == NULL)
		return -1;

	random_add_randomness(sa, ETH_ALEN);
	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
		if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
					    sa, da, bssid, ie, ie_len) > 0) {
			ret = 1;
			break;
		}
	}
	return ret;
}


#ifdef HOSTAPD

#ifdef NEED_AP_MLME

#define HAPD_BROADCAST ((struct hostapd_data *) -1)

static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
					    const u8 *bssid)
{
	size_t i;

	if (bssid == NULL)
		return NULL;
	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
	    bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
		return HAPD_BROADCAST;

	for (i = 0; i < iface->num_bss; i++) {
		if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
			return iface->bss[i];
	}

	return NULL;
}


static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
					const u8 *frame, size_t len)
{
	const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *) frame;
	u16 fc = le_to_host16(hdr->frame_control);
	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	if (hapd == NULL || hapd == HAPD_BROADCAST)
		return;

	ieee802_11_rx_from_unknown(hapd, hdr->addr2,
				   (fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
				   (WLAN_FC_TODS | WLAN_FC_FROMDS));
}


static void hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt)
{
	struct hostapd_iface *iface = hapd->iface;
	const struct ieee80211_hdr *hdr;
	const u8 *bssid;
	struct hostapd_frame_info fi;

	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
	if (bssid == NULL)
		return;

	hapd = get_hapd_bssid(iface, bssid);
	if (hapd == NULL) {
		u16 fc;
		fc = le_to_host16(hdr->frame_control);

		/*
		 * Drop frames to unknown BSSIDs except for Beacon frames which
		 * could be used to update neighbor information.
		 */
		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
		    WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
			hapd = iface->bss[0];
		else
			return;
	}

	os_memset(&fi, 0, sizeof(fi));
	fi.datarate = rx_mgmt->datarate;
	fi.ssi_signal = rx_mgmt->ssi_signal;

	if (hapd == HAPD_BROADCAST) {
		size_t i;
		for (i = 0; i < iface->num_bss; i++)
			ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
					rx_mgmt->frame_len, &fi);
	} else
		ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);

	random_add_randomness(&fi, sizeof(fi));
}


static void hostapd_rx_action(struct hostapd_data *hapd,
			      struct rx_action *rx_action)
{
	struct rx_mgmt rx_mgmt;
	u8 *buf;
	struct ieee80211_hdr *hdr;

	wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
		   " BSSID=" MACSTR " category=%u",
		   MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
		   MAC2STR(rx_action->bssid), rx_action->category);
	wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
		    rx_action->data, rx_action->len);

	buf = os_zalloc(24 + 1 + rx_action->len);
	if (buf == NULL)
		return;
	hdr = (struct ieee80211_hdr *) buf;
	hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
					  WLAN_FC_STYPE_ACTION);
	if (rx_action->category == WLAN_ACTION_SA_QUERY) {
		/*
		 * Assume frame was protected; it would have been dropped if
		 * not.
		 */
		hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
	}
	os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
	os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
	os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
	buf[24] = rx_action->category;
	os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
	os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
	rx_mgmt.frame = buf;
	rx_mgmt.frame_len = 24 + 1 + rx_action->len;
	hostapd_mgmt_rx(hapd, &rx_mgmt);
	os_free(buf);
}


static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf,
			       size_t len, u16 stype, int ok)
{
	struct ieee80211_hdr *hdr;
	hdr = (struct ieee80211_hdr *) buf;
	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	if (hapd == NULL || hapd == HAPD_BROADCAST)
		return;
	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
}

#endif /* NEED_AP_MLME */


static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta = ap_get_sta(hapd, addr);
	if (sta)
		return 0;

	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
		   " - adding a new STA", MAC2STR(addr));
	sta = ap_sta_add(hapd, addr);
	if (sta) {
		hostapd_new_assoc_sta(hapd, sta, 0);
	} else {
		wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
			   MAC2STR(addr));
		return -1;
	}

	return 0;
}


static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
				   const u8 *data, size_t data_len)
{
	struct hostapd_iface *iface = hapd->iface;
	size_t j;

	for (j = 0; j < iface->num_bss; j++) {
		if (ap_get_sta(iface->bss[j], src)) {
			hapd = iface->bss[j];
			break;
		}
	}

	ieee802_1x_receive(hapd, src, data, data_len);
}


void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
			  union wpa_event_data *data)
{
	struct hostapd_data *hapd = ctx;

	switch (event) {
	case EVENT_MICHAEL_MIC_FAILURE:
		michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
		break;
	case EVENT_SCAN_RESULTS:
		if (hapd->iface->scan_cb)
			hapd->iface->scan_cb(hapd->iface);
		break;
#ifdef CONFIG_IEEE80211R
	case EVENT_FT_RRB_RX:
		wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
			      data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
		break;
#endif /* CONFIG_IEEE80211R */
	case EVENT_WPS_BUTTON_PUSHED:
		hostapd_wps_button_pushed(hapd, NULL);
		break;
#ifdef NEED_AP_MLME
	case EVENT_TX_STATUS:
		switch (data->tx_status.type) {
		case WLAN_FC_TYPE_MGMT:
			hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
					   data->tx_status.data_len,
					   data->tx_status.stype,
					   data->tx_status.ack);
			break;
		case WLAN_FC_TYPE_DATA:
			hostapd_tx_status(hapd, data->tx_status.dst,
					  data->tx_status.data,
					  data->tx_status.data_len,
					  data->tx_status.ack);
			break;
		}
		break;
	case EVENT_DRIVER_CLIENT_POLL_OK:
		hostapd_client_poll_ok(hapd, data->client_poll.addr);
		break;
	case EVENT_RX_FROM_UNKNOWN:
		hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.frame,
					    data->rx_from_unknown.len);
		break;
	case EVENT_RX_MGMT:
		hostapd_mgmt_rx(hapd, &data->rx_mgmt);
		break;
#endif /* NEED_AP_MLME */
	case EVENT_RX_PROBE_REQ:
		if (data->rx_probe_req.sa == NULL ||
		    data->rx_probe_req.ie == NULL)
			break;
		hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
				     data->rx_probe_req.da,
				     data->rx_probe_req.bssid,
				     data->rx_probe_req.ie,
				     data->rx_probe_req.ie_len);
		break;
	case EVENT_NEW_STA:
		hostapd_event_new_sta(hapd, data->new_sta.addr);
		break;
	case EVENT_EAPOL_RX:
		hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
				       data->eapol_rx.data,
				       data->eapol_rx.data_len);
		break;
	case EVENT_ASSOC:
		hostapd_notif_assoc(hapd, data->assoc_info.addr,
				    data->assoc_info.req_ies,
				    data->assoc_info.req_ies_len,
				    data->assoc_info.reassoc);
		break;
	case EVENT_DISASSOC:
		if (data)
			hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
		break;
	case EVENT_DEAUTH:
		if (data)
			hostapd_notif_disassoc(hapd, data->deauth_info.addr);
		break;
	case EVENT_STATION_LOW_ACK:
		if (!data)
			break;
		hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
		break;
#ifdef NEED_AP_MLME
	case EVENT_RX_ACTION:
		if (data->rx_action.da == NULL || data->rx_action.sa == NULL ||
		    data->rx_action.bssid == NULL)
			break;
		hostapd_rx_action(hapd, &data->rx_action);
		break;
#endif /* NEED_AP_MLME */
	default:
		wpa_printf(MSG_DEBUG, "Unknown event %d", event);
		break;
	}
}

#endif /* HOSTAPD */
Commit	Line	Data
b5b969e9 JM	1	/*
	2	* hostapd / Callback functions for driver wrappers
	3	* Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*
	9	* Alternatively, this software may be distributed under the terms of BSD
	10	* license.
	11	*
	12	* See README and COPYING for more details.
	13	*/
	14
6226e38d	15	#include "utils/includes.h"
b5b969e9	16
6226e38d	17	#include "utils/common.h"
b5b969e9	18	#include "radius/radius.h"
6e6e8c31	19	#include "drivers/driver.h"
81f4f619	20	#include "common/ieee802_11_defs.h"
c41a1095	21	#include "common/ieee802_11_common.h"
9a3cb18d	22	#include "common/wpa_ctrl.h"
bbb921da	23	#include "crypto/random.h"
ef796391	24	#include "p2p/p2p.h"
54f489be	25	#include "wps/wps.h"
6226e38d JM	26	#include "hostapd.h"
	27	#include "ieee802_11.h"
	28	#include "sta_info.h"
	29	#include "accounting.h"
	30	#include "tkip_countermeasures.h"
	31	#include "iapp.h"
	32	#include "ieee802_1x.h"
	33	#include "wpa_auth.h"
	34	#include "wmm.h"
	35	#include "wps_hostapd.h"
51e2a27a	36	#include "ap_drv_ops.h"
8b06c1ed	37	#include "ap_config.h"
b5b969e9 JM	38
b5b969e9 JM	39
b5b969e9	40	int hostapd_notif_assoc(struct hostapd_data hapd, const u8 addr,
2bb20281	41	const u8 *req_ies, size_t req_ies_len, int reassoc)
b5b969e9 JM	42	{
	43	struct sta_info *sta;
	44	int new_assoc, res;
c41a1095	45	struct ieee802_11_elems elems;
2bb20281 JM	46	const u8 *ie;
2bb20281 JM	47	size_t ielen;
08a74e6a	48	u16 reason = WLAN_REASON_UNSPECIFIED;
b5b969e9	49
68532a9c JM	50	if (addr == NULL) {
	51	/*
	52	* This could potentially happen with unexpected event from the
	53	* driver wrapper. This was seen at least in one case where the
	54	* driver ended up being set to station mode while hostapd was
	55	* running, so better make sure we stop processing such an
	56	* event here.
	57	*/
	58	wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
	59	"no address");
	60	return -1;
	61	}
bbb921da	62	random_add_randomness(addr, ETH_ALEN);
68532a9c	63
b5b969e9 JM	64	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	65	HOSTAPD_LEVEL_INFO, "associated");
	66
2bb20281	67	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);
c41a1095 JM	68	if (elems.wps_ie) {
	69	ie = elems.wps_ie - 2;
	70	ielen = elems.wps_ie_len + 2;
	71	wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
	72	} else if (elems.rsn_ie) {
	73	ie = elems.rsn_ie - 2;
	74	ielen = elems.rsn_ie_len + 2;
	75	wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
	76	} else if (elems.wpa_ie) {
	77	ie = elems.wpa_ie - 2;
	78	ielen = elems.wpa_ie_len + 2;
	79	wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
	80	} else {
	81	ie = NULL;
	82	ielen = 0;
	83	wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
	84	"(Re)AssocReq");
	85	}
	86
b5b969e9 JM	87	sta = ap_get_sta(hapd, addr);
	88	if (sta) {
	89	accounting_sta_stop(hapd, sta);
	90	} else {
	91	sta = ap_sta_add(hapd, addr);
	92	if (sta == NULL)
	93	return -1;
	94	}
17f6b900	95	sta->flags &= ~(WLAN_STA_WPS \| WLAN_STA_MAYBE_WPS \| WLAN_STA_WPS2);
b5b969e9	96
b305c684 JM	97	#ifdef CONFIG_P2P
	98	if (elems.p2p) {
	99	wpabuf_free(sta->p2p_ie);
2bb20281	100	sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
b305c684 JM	101	P2P_IE_VENDOR_TYPE);
	102	}
	103	#endif /* CONFIG_P2P */
	104
b5b969e9 JM	105	if (hapd->conf->wpa) {
b5b969e9 JM	106	if (ie == NULL \|\| ielen == 0) {
633d4469	107	#ifdef CONFIG_WPS
b5b969e9 JM	108	if (hapd->conf->wps_state) {
	109	wpa_printf(MSG_DEBUG, "STA did not include "
	110	"WPA/RSN IE in (Re)Association "
	111	"Request - possible WPS use");
	112	sta->flags \|= WLAN_STA_MAYBE_WPS;
	113	goto skip_wpa_check;
	114	}
633d4469	115	#endif /* CONFIG_WPS */
b5b969e9 JM	116
	117	wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
	118	return -1;
	119	}
633d4469	120	#ifdef CONFIG_WPS
b5b969e9 JM	121	if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
b5b969e9 JM	122	os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
17f6b900	123	struct wpabuf *wps;
b5b969e9	124	sta->flags \|= WLAN_STA_WPS;
17f6b900 JM	125	wps = ieee802_11_vendor_ie_concat(ie, ielen,
	126	WPS_IE_VENDOR_TYPE);
	127	if (wps) {
	128	if (wps_is_20(wps)) {
	129	wpa_printf(MSG_DEBUG, "WPS: STA "
	130	"supports WPS 2.0");
	131	sta->flags \|= WLAN_STA_WPS2;
	132	}
	133	wpabuf_free(wps);
	134	}
b5b969e9 JM	135	goto skip_wpa_check;
b5b969e9 JM	136	}
633d4469	137	#endif /* CONFIG_WPS */
b5b969e9 JM	138
	139	if (sta->wpa_sm == NULL)
	140	sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
	141	sta->addr);
	142	if (sta->wpa_sm == NULL) {
	143	wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
	144	"machine");
	145	return -1;
	146	}
	147	res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
	148	ie, ielen, NULL, 0);
	149	if (res != WPA_IE_OK) {
	150	wpa_printf(MSG_DEBUG, "WPA/RSN information element "
	151	"rejected? (res %u)", res);
	152	wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
355d36a7	153	if (res == WPA_INVALID_GROUP)
08a74e6a	154	reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
355d36a7	155	else if (res == WPA_INVALID_PAIRWISE)
08a74e6a	156	reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
355d36a7	157	else if (res == WPA_INVALID_AKMP)
08a74e6a	158	reason = WLAN_REASON_AKMP_NOT_VALID;
355d36a7 AT	159	#ifdef CONFIG_IEEE80211W
355d36a7 AT	160	else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
08a74e6a	161	reason = WLAN_REASON_INVALID_IE;
355d36a7	162	else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
08a74e6a	163	reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
355d36a7 AT	164	#endif /* CONFIG_IEEE80211W */
355d36a7 AT	165	else
08a74e6a JM	166	reason = WLAN_REASON_INVALID_IE;
08a74e6a JM	167	goto fail;
b5b969e9	168	}
a9aca28b	169	} else if (hapd->conf->wps_state) {
633d4469	170	#ifdef CONFIG_WPS
17f6b900	171	struct wpabuf *wps;
2bb20281 JM	172	if (req_ies)
2bb20281 JM	173	wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
fa15d405 JM	174	WPS_IE_VENDOR_TYPE);
	175	else
	176	wps = NULL;
54f489be	177	#ifdef CONFIG_WPS_STRICT
fa15d405	178	if (wps && wps_validate_assoc_req(wps) < 0) {
08a74e6a	179	reason = WLAN_REASON_INVALID_IE;
fa15d405	180	wpabuf_free(wps);
08a74e6a	181	goto fail;
54f489be	182	}
54f489be	183	#endif /* CONFIG_WPS_STRICT */
fa15d405	184	if (wps) {
a9aca28b	185	sta->flags \|= WLAN_STA_WPS;
fa15d405	186	if (wps_is_20(wps)) {
17f6b900 JM	187	wpa_printf(MSG_DEBUG, "WPS: STA supports "
	188	"WPS 2.0");
	189	sta->flags \|= WLAN_STA_WPS2;
	190	}
a9aca28b JM	191	} else
a9aca28b JM	192	sta->flags \|= WLAN_STA_MAYBE_WPS;
17f6b900	193	wpabuf_free(wps);
633d4469	194	#endif /* CONFIG_WPS */
b5b969e9	195	}
633d4469	196	#ifdef CONFIG_WPS
b5b969e9	197	skip_wpa_check:
633d4469	198	#endif /* CONFIG_WPS */
b5b969e9 JM	199
	200	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
	201	sta->flags \|= WLAN_STA_AUTH \| WLAN_STA_ASSOC;
	202	wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
	203
	204	hostapd_new_assoc_sta(hapd, sta, !new_assoc);
	205
	206	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
	207
ef796391	208	#ifdef CONFIG_P2P
3f4ce13f	209	p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
2bb20281	210	req_ies, req_ies_len);
ef796391 JM	211	#endif /* CONFIG_P2P */
ef796391 JM	212
b5b969e9	213	return 0;
08a74e6a JM	214
	215	fail:
	216	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
	217	ap_free_sta(hapd, sta);
	218	return -1;
b5b969e9 JM	219	}
	220
	221
	222	void hostapd_notif_disassoc(struct hostapd_data hapd, const u8 addr)
	223	{
	224	struct sta_info *sta;
	225
83e843e8 JM	226	if (addr == NULL) {
	227	/*
	228	* This could potentially happen with unexpected event from the
	229	* driver wrapper. This was seen at least in one case where the
	230	* driver ended up reporting a station mode event while hostapd
	231	* was running, so better make sure we stop processing such an
	232	* event here.
	233	*/
	234	wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
	235	"with no address");
1f4c7b6b	236	return;
83e843e8 JM	237	}
83e843e8 JM	238
b5b969e9 JM	239	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	240	HOSTAPD_LEVEL_INFO, "disassociated");
	241
	242	sta = ap_get_sta(hapd, addr);
	243	if (sta == NULL) {
	244	wpa_printf(MSG_DEBUG, "Disassociation notification for "
	245	"unknown STA " MACSTR, MAC2STR(addr));
	246	return;
	247	}
	248
	249	sta->flags &= ~(WLAN_STA_AUTH \| WLAN_STA_ASSOC);
9a3cb18d JM	250	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
9a3cb18d JM	251	MAC2STR(sta->addr));
b5b969e9 JM	252	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
	253	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
	254	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
	255	ap_free_sta(hapd, sta);
	256	}
	257
	258
0d7e5a3a JB	259	void hostapd_event_sta_low_ack(struct hostapd_data hapd, const u8 addr)
	260	{
	261	struct sta_info *sta = ap_get_sta(hapd, addr);
	262
	263	if (!sta \|\| !hapd->conf->disassoc_low_ack)
	264	return;
	265
	266	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	267	HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
	268	"missing ACKs");
	269	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
	270	if (sta)
	271	ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
	272	}
	273
	274
04a85e44 JM	275	int hostapd_probe_req_rx(struct hostapd_data hapd, const u8 sa, const u8 *da,
04a85e44 JM	276	const u8 bssid, const u8 ie, size_t ie_len)
e67b55fb JM	277	{
	278	size_t i;
	279	int ret = 0;
	280
b211f3eb JM	281	if (sa == NULL \|\| ie == NULL)
	282	return -1;
	283
	284	random_add_randomness(sa, ETH_ALEN);
e67b55fb JM	285	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
e67b55fb JM	286	if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
04a85e44	287	sa, da, bssid, ie, ie_len) > 0) {
e67b55fb JM	288	ret = 1;
	289	break;
	290	}
	291	}
	292	return ret;
	293	}
	294
	295
f8b1f695 JM	296	#ifdef HOSTAPD
f8b1f695 JM	297
fe6bdb77	298	#ifdef NEED_AP_MLME
f8b1f695	299
f8b1f695 JM	300	#define HAPD_BROADCAST ((struct hostapd_data *) -1)
	301
	302	static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
	303	const u8 *bssid)
	304	{
	305	size_t i;
	306
	307	if (bssid == NULL)
	308	return NULL;
	309	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
	310	bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
	311	return HAPD_BROADCAST;
	312
	313	for (i = 0; i < iface->num_bss; i++) {
	314	if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
	315	return iface->bss[i];
	316	}
	317
	318	return NULL;
	319	}
	320
	321
	322	static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
0d9fc3d8	323	const u8 *frame, size_t len)
f8b1f695	324	{
0d9fc3d8	325	const struct ieee80211_hdr hdr = (const struct ieee80211_hdr ) frame;
fbbfcbac	326	u16 fc = le_to_host16(hdr->frame_control);
f8b1f695 JM	327	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	328	if (hapd == NULL \|\| hapd == HAPD_BROADCAST)
	329	return;
	330
fbbfcbac FF	331	ieee802_11_rx_from_unknown(hapd, hdr->addr2,
	332	(fc & (WLAN_FC_TODS \| WLAN_FC_FROMDS)) ==
	333	(WLAN_FC_TODS \| WLAN_FC_FROMDS));
f8b1f695 JM	334	}
	335
	336
2a8b7416	337	static void hostapd_mgmt_rx(struct hostapd_data hapd, struct rx_mgmt rx_mgmt)
b5b969e9	338	{
4b9841d3	339	struct hostapd_iface *iface = hapd->iface;
b57e086c	340	const struct ieee80211_hdr *hdr;
4b9841d3	341	const u8 *bssid;
2a8b7416	342	struct hostapd_frame_info fi;
4b9841d3	343
2a8b7416 JM	344	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
2a8b7416 JM	345	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
4b9841d3 JM	346	if (bssid == NULL)
	347	return;
	348
	349	hapd = get_hapd_bssid(iface, bssid);
	350	if (hapd == NULL) {
	351	u16 fc;
	352	fc = le_to_host16(hdr->frame_control);
	353
	354	/*
	355	* Drop frames to unknown BSSIDs except for Beacon frames which
	356	* could be used to update neighbor information.
	357	*/
	358	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
	359	WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
	360	hapd = iface->bss[0];
	361	else
	362	return;
	363	}
	364
2a8b7416 JM	365	os_memset(&fi, 0, sizeof(fi));
	366	fi.datarate = rx_mgmt->datarate;
	367	fi.ssi_signal = rx_mgmt->ssi_signal;
	368
4b9841d3 JM	369	if (hapd == HAPD_BROADCAST) {
	370	size_t i;
	371	for (i = 0; i < iface->num_bss; i++)
2a8b7416 JM	372	ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
2a8b7416 JM	373	rx_mgmt->frame_len, &fi);
4b9841d3	374	} else
2a8b7416	375	ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);
bbb921da JM	376
bbb921da JM	377	random_add_randomness(&fi, sizeof(fi));
b5b969e9 JM	378	}
	379
	380
9e2704c3 JM	381	static void hostapd_rx_action(struct hostapd_data *hapd,
	382	struct rx_action *rx_action)
	383	{
	384	struct rx_mgmt rx_mgmt;
	385	u8 *buf;
	386	struct ieee80211_hdr *hdr;
	387
	388	wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
	389	" BSSID=" MACSTR " category=%u",
	390	MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
	391	MAC2STR(rx_action->bssid), rx_action->category);
	392	wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
	393	rx_action->data, rx_action->len);
	394
	395	buf = os_zalloc(24 + 1 + rx_action->len);
	396	if (buf == NULL)
	397	return;
	398	hdr = (struct ieee80211_hdr *) buf;
	399	hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
	400	WLAN_FC_STYPE_ACTION);
	401	if (rx_action->category == WLAN_ACTION_SA_QUERY) {
	402	/*
	403	* Assume frame was protected; it would have been dropped if
	404	* not.
	405	*/
	406	hdr->frame_control \|= host_to_le16(WLAN_FC_ISWEP);
	407	}
	408	os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
	409	os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
	410	os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
	411	buf[24] = rx_action->category;
	412	os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
	413	os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
	414	rx_mgmt.frame = buf;
	415	rx_mgmt.frame_len = 24 + 1 + rx_action->len;
	416	hostapd_mgmt_rx(hapd, &rx_mgmt);
	417	os_free(buf);
	418	}
	419
	420
f8b1f695 JM	421	static void hostapd_mgmt_tx_cb(struct hostapd_data hapd, const u8 buf,
f8b1f695 JM	422	size_t len, u16 stype, int ok)
b5b969e9	423	{
4b9841d3 JM	424	struct ieee80211_hdr *hdr;
	425	hdr = (struct ieee80211_hdr *) buf;
	426	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	427	if (hapd == NULL \|\| hapd == HAPD_BROADCAST)
	428	return;
b5b969e9 JM	429	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
b5b969e9 JM	430	}
f82ef4d8	431
f8b1f695	432	#endif /* NEED_AP_MLME */
ad1e68e6 JM	433
ad1e68e6 JM	434
a8e0505b JM	435	static int hostapd_event_new_sta(struct hostapd_data hapd, const u8 addr)
	436	{
	437	struct sta_info *sta = ap_get_sta(hapd, addr);
	438	if (sta)
	439	return 0;
	440
	441	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
	442	" - adding a new STA", MAC2STR(addr));
	443	sta = ap_sta_add(hapd, addr);
	444	if (sta) {
	445	hostapd_new_assoc_sta(hapd, sta, 0);
	446	} else {
	447	wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
	448	MAC2STR(addr));
	449	return -1;
	450	}
	451
	452	return 0;
	453	}
	454
	455
	456	static void hostapd_event_eapol_rx(struct hostapd_data hapd, const u8 src,
	457	const u8 *data, size_t data_len)
	458	{
	459	struct hostapd_iface *iface = hapd->iface;
	460	size_t j;
	461
	462	for (j = 0; j < iface->num_bss; j++) {
	463	if (ap_get_sta(iface->bss[j], src)) {
	464	hapd = iface->bss[j];
	465	break;
	466	}
	467	}
	468
	469	ieee802_1x_receive(hapd, src, data, data_len);
	470	}
	471
	472
9646a8ab	473	void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
ad1e68e6 JM	474	union wpa_event_data *data)
	475	{
	476	struct hostapd_data *hapd = ctx;
	477
	478	switch (event) {
	479	case EVENT_MICHAEL_MIC_FAILURE:
	480	michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
	481	break;
	482	case EVENT_SCAN_RESULTS:
	483	if (hapd->iface->scan_cb)
	484	hapd->iface->scan_cb(hapd->iface);
	485	break;
08fd8c15	486	#ifdef CONFIG_IEEE80211R
f2dab64e	487	case EVENT_FT_RRB_RX:
08fd8c15 JM	488	wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
	489	data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
	490	break;
	491	#endif /* CONFIG_IEEE80211R */
fcf0f87d	492	case EVENT_WPS_BUTTON_PUSHED:
d601247c	493	hostapd_wps_button_pushed(hapd, NULL);
fcf0f87d	494	break;
f8b1f695 JM	495	#ifdef NEED_AP_MLME
	496	case EVENT_TX_STATUS:
	497	switch (data->tx_status.type) {
	498	case WLAN_FC_TYPE_MGMT:
	499	hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
	500	data->tx_status.data_len,
	501	data->tx_status.stype,
	502	data->tx_status.ack);
	503	break;
	504	case WLAN_FC_TYPE_DATA:
	505	hostapd_tx_status(hapd, data->tx_status.dst,
	506	data->tx_status.data,
	507	data->tx_status.data_len,
	508	data->tx_status.ack);
	509	break;
	510	}
	511	break;
bcf24348 JB	512	case EVENT_DRIVER_CLIENT_POLL_OK:
	513	hostapd_client_poll_ok(hapd, data->client_poll.addr);
	514	break;
f8b1f695	515	case EVENT_RX_FROM_UNKNOWN:
0d9fc3d8	516	hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.frame,
f8b1f695 JM	517	data->rx_from_unknown.len);
	518	break;
	519	case EVENT_RX_MGMT:
2a8b7416	520	hostapd_mgmt_rx(hapd, &data->rx_mgmt);
f8b1f695 JM	521	break;
f8b1f695 JM	522	#endif /* NEED_AP_MLME */
a0e0d3bb	523	case EVENT_RX_PROBE_REQ:
b211f3eb JM	524	if (data->rx_probe_req.sa == NULL \|\|
	525	data->rx_probe_req.ie == NULL)
	526	break;
a0e0d3bb	527	hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
04a85e44 JM	528	data->rx_probe_req.da,
04a85e44 JM	529	data->rx_probe_req.bssid,
a0e0d3bb JM	530	data->rx_probe_req.ie,
	531	data->rx_probe_req.ie_len);
	532	break;
a70a5d6d	533	case EVENT_NEW_STA:
a8e0505b JM	534	hostapd_event_new_sta(hapd, data->new_sta.addr);
	535	break;
	536	case EVENT_EAPOL_RX:
	537	hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
	538	data->eapol_rx.data,
	539	data->eapol_rx.data_len);
	540	break;
1d041bec JM	541	case EVENT_ASSOC:
	542	hostapd_notif_assoc(hapd, data->assoc_info.addr,
	543	data->assoc_info.req_ies,
39b08b5f SP	544	data->assoc_info.req_ies_len,
39b08b5f SP	545	data->assoc_info.reassoc);
1d041bec JM	546	break;
	547	case EVENT_DISASSOC:
	548	if (data)
	549	hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
	550	break;
	551	case EVENT_DEAUTH:
	552	if (data)
	553	hostapd_notif_disassoc(hapd, data->deauth_info.addr);
	554	break;
0d7e5a3a JB	555	case EVENT_STATION_LOW_ACK:
	556	if (!data)
	557	break;
	558	hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
	559	break;
7cc7307d	560	#ifdef NEED_AP_MLME
9e2704c3 JM	561	case EVENT_RX_ACTION:
	562	if (data->rx_action.da == NULL \|\| data->rx_action.sa == NULL \|\|
	563	data->rx_action.bssid == NULL)
	564	break;
	565	hostapd_rx_action(hapd, &data->rx_action);
	566	break;
7cc7307d	567	#endif /* NEED_AP_MLME */
ad1e68e6 JM	568	default:
	569	wpa_printf(MSG_DEBUG, "Unknown event %d", event);
	570	break;
	571	}
	572	}
f8b1f695 JM	573
f8b1f695 JM	574	#endif /* HOSTAPD */